Skip to content

Commit cd0e5e5

Browse files
josecelanojosecelano
committed
fix: [#28] update nginx templates to resolve HTTP/2 deprecation warnings
- Update deprecated 'listen 443 ssl http2' syntax to 'listen 443 ssl' + 'http2 on' - Remove commented HTTPS configuration from nginx.conf.tpl (moved to nginx-https-extension.conf.tpl) - Clean up TODO comments about variable escaping (now properly resolved) - Maintain separation of HTTP (nginx.conf.tpl) and HTTPS (nginx-https-extension.conf.tpl) configurations - Fix all nginx variable escaping using DOLLAR environment variable
1 parent 509c51f commit cd0e5e5

File tree

5 files changed

+32
-139
lines changed

5 files changed

+32
-139
lines changed

‎infrastructure/config/templates/application/nginx/nginx-https-extension.conf.tpl‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ upstream grafana {
1515

1616
# HTTPS server for tracker subdomain
1717
server {
18-
listen 443 ssl http2;
19-
listen [::]:443 ssl http2;
18+
listen 443 ssl;
19+
listen [::]:443 ssl;
20+
http2 on;
2021
server_name ${TRACKER_DOMAIN};
2122

2223
server_tokens off;
@@ -84,8 +85,9 @@ server {
8485

8586
# HTTPS server for grafana subdomain
8687
server {
87-
listen 443 ssl http2;
88-
listen [::]:443 ssl http2;
88+
listen 443 ssl;
89+
listen [::]:443 ssl;
90+
http2 on;
8991
server_name ${GRAFANA_DOMAIN};
9092

9193
server_tokens off;

‎infrastructure/config/templates/application/nginx/nginx-https-selfsigned.conf.tpl‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ upstream grafana {
1515

1616
# HTTPS server for tracker subdomain
1717
server {
18-
listen 443 ssl http2;
19-
listen [::]:443 ssl http2;
18+
listen 443 ssl;
19+
listen [::]:443 ssl;
20+
http2 on;
2021
server_name ${TRACKER_DOMAIN};
2122

2223
server_tokens off;
@@ -73,8 +74,9 @@ server {
7374

7475
# HTTPS server for grafana subdomain
7576
server {
76-
listen 443 ssl http2;
77-
listen [::]:443 ssl http2;
77+
listen 443 ssl;
78+
listen [::]:443 ssl;
79+
http2 on;
7880
server_name ${GRAFANA_DOMAIN};
7981

8082
server_tokens off;

‎infrastructure/config/templates/application/nginx/nginx.conf.tpl‎

Lines changed: 0 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,6 @@
55
# - Nginx variables (like $proxy_add_x_forwarded_for, $host, $http_upgrade) must be escaped
66
# - Use ${DOLLAR} environment variable to represent literal $ in nginx config
77
# - Example: ${DOLLAR}proxy_add_x_forwarded_for becomes $proxy_add_x_forwarded_for
8-
#
9-
# TODO: Fix the commented HTTPS configuration section below
10-
# - The HTTPS configuration has inconsistent variable escaping
11-
# - Some nginx variables use literal $ (incorrect) while others should use ${DOLLAR}
12-
# - Line 117: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; (needs ${DOLLAR})
13-
# - Lines with $host, $http_upgrade, $connection_upgrade also need escaping
14-
# - SSL certificate paths and other static values are correct as-is
158

169
server
1710
{
@@ -63,125 +56,3 @@ server
6356
root /var/www/html;
6457
}
6558
}
66-
67-
#server
68-
#{
69-
# listen 443 ssl http2;
70-
# listen [::]:443 ssl http2;
71-
# server_name tracker.torrust-demo.com;
72-
#
73-
# server_tokens off;
74-
#
75-
# ssl_certificate /etc/letsencrypt/live/tracker.torrust-demo.com/fullchain.pem;
76-
# ssl_certificate_key /etc/letsencrypt/live/tracker.torrust-demo.com/privkey.pem;
77-
#
78-
# ssl_buffer_size 8k;
79-
#
80-
# ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
81-
#
82-
# ssl_protocols TLSv1.2;
83-
# ssl_prefer_server_ciphers on;
84-
#
85-
# ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
86-
#
87-
# ssl_ecdh_curve secp384r1;
88-
# ssl_session_tickets off;
89-
#
90-
# ssl_stapling on;
91-
# ssl_stapling_verify on;
92-
# resolver 8.8.8.8;
93-
#
94-
# location /api/
95-
# {
96-
# try_files $uri @tracker-api;
97-
# }
98-
#
99-
# location /
100-
# {
101-
# try_files $uri @tracker-http;
102-
# }
103-
#
104-
# location @tracker-api
105-
# {
106-
# proxy_pass http://tracker:1212;
107-
# add_header X-Frame-Options "SAMEORIGIN" always;
108-
# add_header X-XSS-Protection "1; mode=block" always;
109-
# add_header X-Content-Type-Options "nosniff" always;
110-
# add_header Referrer-Policy "no-referrer-when-downgrade" always;
111-
# add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
112-
# #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
113-
# # enable strict transport security only if you understand the implications
114-
# }
115-
#
116-
# location @tracker-http
117-
# {
118-
# proxy_pass http://tracker:7070;
119-
# add_header X-Frame-Options "SAMEORIGIN" always;
120-
# add_header X-XSS-Protection "1; mode=block" always;
121-
# add_header X-Content-Type-Options "nosniff" always;
122-
# add_header Referrer-Policy "no-referrer-when-downgrade" always;
123-
# add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
124-
# #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
125-
# # enable strict transport security only if you understand the implications
126-
#
127-
# proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
128-
# }
129-
#
130-
# root /var/www/html;
131-
# index index.html index.htm index.nginx-debian.html;
132-
#}
133-
134-
## This is required to proxy Grafana Live WebSocket connections.
135-
#map $http_upgrade $connection_upgrade {
136-
# default upgrade;
137-
# '' close;
138-
#}
139-
#
140-
#upstream grafana {
141-
# server grafana:3000;
142-
#}
143-
#
144-
#server
145-
#{
146-
# listen 443 ssl http2;
147-
# listen [::]:443 ssl http2;
148-
# server_name grafana.torrust-demo.com;
149-
#
150-
# server_tokens off;
151-
#
152-
# ssl_certificate /etc/letsencrypt/live/grafana.torrust-demo.com/fullchain.pem;
153-
# ssl_certificate_key /etc/letsencrypt/live/grafana.torrust-demo.com/privkey.pem;
154-
#
155-
# ssl_buffer_size 8k;
156-
#
157-
# ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
158-
#
159-
# ssl_protocols TLSv1.2;
160-
# ssl_prefer_server_ciphers on;
161-
#
162-
# ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
163-
#
164-
# ssl_ecdh_curve secp384r1;
165-
# ssl_session_tickets off;
166-
#
167-
# ssl_stapling on;
168-
# ssl_stapling_verify on;
169-
# resolver 8.8.8.8;
170-
#
171-
# location / {
172-
# proxy_set_header Host $host;
173-
# proxy_pass http://grafana;
174-
# }
175-
#
176-
# # Proxy Grafana Live WebSocket connections.
177-
# location /api/live/ {
178-
# proxy_http_version 1.1;
179-
# proxy_set_header Upgrade $http_upgrade;
180-
# proxy_set_header Connection $connection_upgrade;
181-
# proxy_set_header Host $host;
182-
# proxy_pass http://grafana;
183-
# }
184-
#
185-
# root /var/www/html;
186-
# index index.html index.htm index.nginx-debian.html;
187-
#}

‎infrastructure/scripts/provision-infrastructure.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ provision_infrastructure() {
232232

233233
# Main execution
234234
main() {
235-
log_info "Starting infrastructure provisioning (Twelve-Factor Build Stage)"
235+
log_info "Starting infrastructure provisioning"
236236
log_info "Environment Type: ${ENVIRONMENT_TYPE}"
237237

238238
# Load environment configuration
@@ -259,7 +259,7 @@ main() {
259259
# Show help
260260
show_help() {
261261
cat <<EOF
262-
Infrastructure Provisioning Script (Twelve-Factor Build Stage)
262+
Infrastructure Provisioning Script
263263
264264
Usage: ENVIRONMENT_TYPE=<type> ENVIRONMENT_FILE=<file> $0 [ACTION]
265265

‎tests/test-e2e.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,24 @@ test_infrastructure_provisioning() {
9292
log_info "No existing infrastructure to clean up"
9393
fi
9494

95+
# Generate E2E environment configuration (ensures latest templates are used)
96+
log_info "Generating E2E environment configuration..."
97+
local config_file="infrastructure/config/environments/${ENVIRONMENT_FILE}.env"
98+
99+
# Remove existing configuration file to ensure we use latest templates
100+
if [ -f "${config_file}" ]; then
101+
log_info "Removing existing configuration file: ${config_file}"
102+
rm -f "${config_file}"
103+
fi
104+
105+
# Generate fresh configuration from templates
106+
if ! make infra-config ENVIRONMENT_TYPE="${ENVIRONMENT_TYPE}" PROVIDER="libvirt"; then
107+
log_error "Failed to generate E2E environment configuration"
108+
return 1
109+
fi
110+
111+
log_success "E2E environment configuration generated: ${config_file}"
112+
95113
# Initialize infrastructure (Step 2.1 from guide)
96114
log_info "Initializing infrastructure..."
97115
if ! make infra-init ENVIRONMENT_TYPE="${ENVIRONMENT_TYPE}" ENVIRONMENT_FILE="${ENVIRONMENT_FILE}"; then

0 commit comments

Comments
 (0)